Weaknesses of type CWE-732

791 results

Permissões inadequadas em recursos críticos de segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos, credenciais, configurações críticas ou dados pessoais a quem não deveria ter acesso.

Example

Um arquivo de configuração contendo chaves de API é criado com permissões 644 (legível por qualquer usuário do sistema) ao invés de 600 (apenas o proprietário). Um atacante local lê a chave e compromete a aplicação na nuvem. Ou um diretório temporário armazena tokens de sessão com permissões 777, permitindo que outros processos roubem sessões ativas.

How to mitigate

Aplique o princípio do menor privilégio: configure permissões restritivas no momento da criação (ex: 600 para arquivos sensíveis, 700 para diretórios). Use umask apropriado, revise periodicamente as permissões de recursos críticos e automatize verificações de compliance com ferramentas como Terraform ou Ansible para manter a postura correta.

CVE-2025-25373CRITICALThe Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the EPSS 0.5%CVE-2023-32979MEDIUMJenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with OverallEPSS 0.5%CVE-2022-33163MEDIUMIBM Security Directory Suite VA information disclosureEPSS 0.5%CVE-2024-10018CRITICALImproper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any unexported component.EPSS 0.5%CVE-2025-21564HIGHVulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). The supported versEPSS 0.5%CVE-2022-30354HIGHOvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserWithTeam. AuthenticatiEPSS 0.5%CVE-2022-45193MEDIUMCBRN-Analysis before 22 has weak file permissions under Public Profile, leading to disclosure of file contents or privilege escalation.EPSS 0.5%CVE-2026-61155CRITICALVulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version EPSS 0.5%CVE-2025-20387HIGHIncorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgradeEPSS 0.5%CVE-2025-20386HIGHIncorrect permission assignment on Splunk Enterprise for Windows during new installation or upgradeEPSS 0.5%CVE-2021-3631—A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to aEPSS 0.5%CVE-2022-24769MEDIUMDefault inheritable capabilities for linux container should be emptyEPSS 0.5%CVE-2024-6435HIGHRockwell Automation Privilege Escalation Vulnerability in Pavilion8®EPSS 0.5%CVE-2026-29188CRITICALFile Browser: TUS Delete Endpoint Bypasses Delete Permission CheckEPSS 0.5%CVE-2025-43247MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS VenturEPSS 0.5%CVE-2024-38337CRITICALIBM Sterling Secure Proxy improper input validationEPSS 0.5%CVE-2023-4565MEDIUMBroadcast permission control vulnerability in the framework module. Successful exploitation of this vulnerability may cause the hotspot featEPSS 0.5%CVE-2023-49580HIGHInformation disclosure in SAP GUI for Windows and SAP GUI for JavaEPSS 0.5%CVE-2023-0944MEDIUMBhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, EPSS 0.5%CVE-2026-85887HIGHM365 Copilot Information Disclosure VulnerabilityEPSS 0.5%